The md5 benchmark in bug 621203 has the following safe_add function: function safe_add(x, y) { return ((x|0) + (y|0))|0; } If the add overflowed in the interpreter, Ion uses a double addition with a bunch of int32 <-> double conversions. Type analysis could easily detect this case and respecialize the MAdd as int32. Emscripten/Mandreel also use (int32 + int32)|0 a lot so this may help there too.

Ooh, good find!

Note that &-1 is used in some cases (Mandreel for example), so would be nice to optimize that too.

The given testcase does not generate an overflow check anymore (since changes to truncate happened)